Script Condition

A watch condition that evaluates a script. The default scripting
language is painless. You can use any of the scripting languages supported by
Elasticsearch as long as the language supports evaluating expressions to Boolean
values. Note that the mustache and expression languages are too limited to be
used by this condition. For more information, see Scripting
in the Elasticsearch Reference.

For Groovy, you must explicitly enable dynamic scripts
in elasticsearch.yml to use inline or stored scripts. To enable groovy
scripting for watches only, you can set script.engine.groovy.inline.xpack_watch: true.

Alternatively, starting with 5.0, Elasticsearch is shipped with the new
Painless scripting language. Painless was
created and designed specifically for use in Elasticsearch. Beyond providing an
extensive feature set, its biggest trait is that it’s properly sandboxed and safe
to use anywhere in the system (including in Watcher) without the need to enable
dynamic scripting.

Using a Script Condition

The following snippet configures an inline script condition that always returns
true:

"condition" : {
"script" : "return true"
}

This example defines a script as a simple string. This format is actually a
shortcut for defining an inline script. The
formal definition of a script is an object that specifies the script type and
optional language and parameter values. If the lang attribute is omitted, the
language defaults to painless. Elasticsearch supports three script types:
Inline, File, and
Stored.

For example, the following snippet shows a formal definition of an inline
script that explicitly specifies the language and defines a single script
parameter, result:

When you’re using a scripted condition to evaluate an Elasticsearch response,
keep in mind that the fields in the response are no longer in their native data
types. For example, the @timestamp in the response is a string, rather than a
DateTime. To compare the response @timestamp against the ctx.execution_time,
you need to parse the @timestamp string into a DateTime. For example: